GCVE - cpe:2.3:a:ez:ez_publish:3.5.2:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:ez:ez_publish:3.5.2:*:*:*:*:*:*:*

part: a version: 3.5.2 update: *

Vendor	Ez (`7b59e160-3d8c-59e2-a2ad-e6730c6f4258`)
Product	Ez Publish (`ab65bf08-1558-5993-86c6-e15315a496e6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/ezsystems/ezpublish-kernel`	purl2cpe	2026-06-01 10:12:39.081895
`pkg:github/ezsystems/ezpublish-legacy`	purl2cpe	2026-06-01 10:12:39.081896

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2005-4857`	vulnerable	2026-06-08 04:48:45.379671	Details available eZ publish 3.5 before 3.5.7, 3.6 before 3.6.5, 3.7 before 3.7.3, and 3.8 before 20051128 allows remote authenticated users to cause a denial of service (Apache httpd segmentation fault) via a request to content/advancedsearch.php with an empty SearchContentClassID parameter, reportedly related to a "memory addressing error". Published: 2007-07-06T19:00:00.000Z Updated: 2024-09-16T16:12:42.738Z Open on db.gcve.eu Reference links http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_6_x_3_7_x_to_3_8_0 http://issues.ez.no/7459	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4856`	vulnerable	2026-06-08 04:48:45.379090	Details available The admin interface in eZ publish 3.5 before 3.5.7, 3.6 before 3.6.5, 3.7 before 3.7.3, and 3.8 before 20051110 does not properly handle authorization errors, which allows remote attackers to obtain sensitive information and see the admin pagelayout and associated templates via a request with (1) "anything after the url" or (2) a "wrong url". Published: 2007-07-06T19:00:00.000Z Updated: 2024-09-17T01:21:26.782Z Open on db.gcve.eu Reference links http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_6_x_3_7_x_to_3_8_0 http://issues.ez.no/6703	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4854`	vulnerable	2026-06-08 04:48:45.358383	Details available eZ publish 3.5 through 3.7 before 20050830 does not use a folder's read permissions to restrict notifications, which allows remote authenticated users to obtain sensitive information about changes to content in arbitrary folders. Published: 2007-07-06T19:00:00.000Z Updated: 2024-09-17T01:21:28.680Z Open on db.gcve.eu Reference links http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_6_x_3_7_x_to_3_8_0 http://issues.ez.no/6355	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4853`	vulnerable	2026-06-08 04:48:45.356845	Details available The default configuration of the forum package in eZ publish 3.5 before 3.5.5, 3.6 before 3.6.2, 3.7 before 3.7.0rc2, and 3.8 before 20050818 does not restrict edit permissions to a posting's owner, which allows remote authenticated users to edit arbitrary postings. Published: 2007-07-06T19:00:00.000Z Updated: 2024-09-16T20:17:15.055Z Open on db.gcve.eu Reference links http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_6_x_3_7_x_to_3_8_0 http://issues.ez.no/7052	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.